Redfin and Rocket data breach lawsuits (2026)

At least five proposed class action lawsuits have been filed against Redfin Corporation and Rocket Limited Partnership, which does business as Rocket Companies, over a data security incident at Redfin. The suits were filed in the U.S. District Court for the Western District of Washington in Seattle between September 28 and October 16, 2026.

The complaints allege that names, Social Security numbers, driver's license numbers and financial account information were exposed. The plaintiffs whose complaints we reviewed say they gave Redfin their information to get a job or professional placement services. Redfin says it found suspicious activity on a single employee account in early March, notified potentially affected people and offered two years of credit monitoring. It says it expects to prevail. No court has ruled, and there is no settlement.

Redfin is a Delaware corporation based in Seattle that runs a real estate brokerage and home-search website. Rocket Limited Partnership is a Michigan partnership based in Detroit. The complaints describe Rocket as a homeownership platform and Redfin's parent company. The Seattle Times reports that Rocket Companies acquired Redfin last year and that Rocket Limited Partnership oversees Rocket Mortgage, Rocket Loans, Rocket Close and Rocket Money.

The five suits on the court's docket are:

• Rolland, No. 2:26-cv-03648, filed September 28 by Amy Rolland of Orlando, Florida, represented by McNaul Ebel and Kopelowitz Ostrow.
• Marshall, No. 2:26-cv-03651, filed September 28.
• Johnson, No. 2:26-cv-03670, filed September 29 by Matthew Johnson of Tacoma, Washington, represented by McNaul Ebel and Shamis & Gentile.
• Moreno, No. 2:26-cv-03915, filed October 14 by Frankie Moreno, a Texas resident who worked for Redfin from September 2020 to November 2022, according to The Seattle Times.
• Titarchuk, No. 2:26-cv-03960, filed October 16.

Class Action Pulse reviewed the Rolland and Johnson complaints. The Moreno details come from Seattle Times reporting. We have not reviewed the Marshall or Titarchuk complaints.

Redfin reported the incident to the Massachusetts Office of Consumer Affairs and Business Regulation on September 24, 2026. The state's public breach log lists the report as number 2026-1615. It says 55 Massachusetts residents were affected and marks Social Security numbers, financial account numbers and driver's license numbers as breached. It marks medical records and credit or debit card numbers as not breached. The log covers Massachusetts residents only, so it does not show the national total.

The complaints say Redfin has not publicly explained when the breach happened, when it was found or how it occurred. According to The Seattle Times, the Massachusetts notice says the incident "may have resulted in an unauthorized third party accessing your personal information," without more detail.

The plaintiffs allege that Redfin and Rocket did not use reasonable security, did not detect the intrusion in time and gave incomplete notice. Rolland and Johnson each say they provided information "as a condition of receiving employment and/or professional placement services." Moreno, according to The Seattle Times, wants the class to cover U.S. employees whose information was compromised and believes it could include thousands of people. The complaints claim negligence, unjust enrichment, breach of implied contract and violations of the Washington Consumer Protection Act. These are allegations.

A Redfin spokesperson told The Seattle Times: "In early March, Redfin identified suspicious activity involving a single employee account. Redfin promptly engaged forensic experts, and its systems were reviewed and confirmed secure." The spokesperson said potentially affected people were notified and offered two years of free credit monitoring, and that "the company is confident it will prevail in the related litigation once all the facts are presented." Rocket referred questions to Redfin's statement.

Nothing on the merits. The Rolland and Johnson cases carry Judge James L. Robart's initials on the docket. The court has not combined the five suits, appointed lead counsel, ruled on any defense or certified a class. Whether Redfin home buyers, sellers or app users were affected has not been established in any public record we reviewed.

The Rolland and Johnson complaints propose a class of "all persons who were impacted by the Data Breach and receive a Notice." The Moreno suit, as reported, focuses on current and former U.S. employees. Redfin, Rocket, their affiliates and the assigned judge are excluded.

If you received a Redfin breach notice about this incident, you may fall within the proposed definitions. People who worked for Redfin or applied for placement there are the group the reviewed complaints describe. No class has been certified, and the final definition may be narrower or broader.

Look for a Redfin notice letter or email about this incident, and keep it. If it includes a credit monitoring code, read the enrollment terms before signing up.

Consider a credit freeze with Equifax, Experian and TransUnion, because the complaints say Social Security numbers were exposed. Review bank statements for charges you do not recognize. Readers can contact the filing firms or their own lawyer. Contacting a firm does not make you a client, and an inquiry through Class Action Pulse does not join a lawsuit.

No money is available now. The complaints ask for damages, restitution and court orders requiring better security. Under the Washington Consumer Protection Act, they ask the court to triple actual damages up to $25,000 per class member. That cap is a statutory limit, not an estimate of any payment. Redfin's offer of two years of credit monitoring is separate from the lawsuits.

• Early March 2026: Redfin says it found suspicious activity on one employee account.
• September 24, 2026: Redfin reports the incident to Massachusetts.
• September 28 to October 16, 2026: Five lawsuits are filed in Seattle.
• October 16, 2026: Redfin's statement appears in The Seattle Times.

There is no claim deadline. Opt-out and objection rights come only after certification or a proposed settlement.

A data breach is unauthorized access to stored personal information. A credit freeze blocks new credit from being opened in your name until you lift it. The Washington Consumer Protection Act is a state law against unfair or deceptive business practices. Consolidation means combining related lawsuits into one case.

With five suits in one court, the plaintiffs' lawyers or the defendants may ask the court to consolidate them and appoint interim lead counsel. A consolidated complaint would likely follow, and Redfin and Rocket would then respond, possibly with a motion to dismiss.

A practical note: a credit freeze is free at all three bureaus and can be lifted temporarily when you apply for a loan or apartment.

The Rolland and Johnson complaints support the parties, class definition, alleged data types, claims and relief. The Massachusetts breach report supports the September 24 filing, the 55 residents and the data categories. The Seattle Times supports Redfin's statement and the Moreno details. The national number affected, and whether customers were affected, are unknown.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.